fix: block path traversal via ".." in dag_id and run_id by YoannAbriel · Pull Request #63296 · apache/airflow

YoannAbriel · 2026-03-10T20:07:40Z

Problem

validate_key() and validate_run_id() both allow .. in their values. Since dag_id and run_id are used in log file paths (e.g. dag_id=.../run_id=.../), a crafted value containing .. could theoretically traverse outside the intended log directory.

Root Cause

KEY_REGEX (^[\w.-]+$) matches .. as valid consecutive dots. validate_run_id uses a configurable allowed_run_id_pattern that could also permit ... Neither function checks for path traversal sequences.

Fix

Added an explicit .. check in both validate_key() (raises AirflowException) and validate_run_id() (raises ValueError) before any other validation. Added corresponding unit tests for both functions.

Closes: #63295

Was generative AI tooling used to co-author this PR?

Yes — Claude Code

Generated-by: Claude Code following the guidelines

Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.

potiuk

This is extremely risky change if we do not have a mechanism to allow those.

If we merge thius change, suddenly all the Dags of someone who has .. in their name will fail and they will have to manually convert their Dags. People migh have weird conventions for names and

potiuk · 2026-03-10T20:28:33Z

cc: @ferruzzi -> did you think how to handle the case if someone already uses .. ? I do not think this "Weak" possible issue is worth the risk ? WDYT?

ferruzzi · 2026-03-10T21:05:01Z

I'm not honestly sure how big of a risk it is, in the end, but it did seem like a reasonable concern. IMHO, we can have a flag to allow it, set to false. That way we're "safe by default" and the user has to explicitly allow it? It's still breaking, but with some allowance??

YoannAbriel · 2026-03-10T22:01:25Z

Good point — will add a config flag (default: block) so existing users with .. in IDs aren't broken. Will update the PR.

ferruzzi · 2026-03-10T22:15:58Z

Since this is a breaking change, it will also need a newsfragment

ferruzzi

Still pending the config flag to enable/disable the feature, but nice progress. Ping me when you are ready for a re-review.

validate_key() and validate_run_id() allow ".." which can be used for path traversal when these values end up in log file paths. Reject any key or run_id containing ".." early in validation. Closes: apache#63295

… in create_dagrun - Add [core] allow_dotdot_in_ids config flag (default: False) so existing users with '..' in their IDs can opt out of the blocking behavior - Add '..' check in SerializedDAG.create_dagrun() before the regex check, fixing the test_dag_run_id_rejects_path_traversal failure where create_dagrun raised a regex mismatch error before the traversal check - Collapse multi-line raise ValueError in dagrun.py to fix static check - Make all '..' checks conditional on allow_dotdot_in_ids config

… version_added to 3.3.0

ferruzzi

I wonder if we might want to make and import a constant like DOUBLE_DOT - ".." rather than littering magic strings around, but I'm fine with it as-is... that may be overkill.

potiuk · 2026-03-24T06:13:36Z

I wonder if we might want to make and import a constant like DOUBLE_DOT - ".." rather than littering magic strings around, but I'm fine with it as-is... that may be overkill.

Yeah.. It's longer than ".." and DOUBLE_DOT constant is unlikely to change to something else (like "..." to justify DRY).

* fix: block path traversal via ".." in dag_id and run_id validate_key() and validate_run_id() allow ".." which can be used for path traversal when these values end up in log file paths. Reject any key or run_id containing ".." early in validation. Closes: #63295 * Add newsfragment for breaking change * fix: add config flag allow_dotdot_in_ids and fix path traversal check in create_dagrun - Add [core] allow_dotdot_in_ids config flag (default: False) so existing users with '..' in their IDs can opt out of the blocking behavior - Add '..' check in SerializedDAG.create_dagrun() before the regex check, fixing the test_dag_run_id_rejects_path_traversal failure where create_dagrun raised a regex mismatch error before the traversal check - Collapse multi-line raise ValueError in dagrun.py to fix static check - Make all '..' checks conditional on allow_dotdot_in_ids config * refactor: rename allow_dotdot_in_ids to allow_double_dot_in_ids, bump version_added to 3.3.0

* fix: block path traversal via ".." in dag_id and run_id validate_key() and validate_run_id() allow ".." which can be used for path traversal when these values end up in log file paths. Reject any key or run_id containing ".." early in validation. Closes: apache#63295 * Add newsfragment for breaking change * fix: add config flag allow_dotdot_in_ids and fix path traversal check in create_dagrun - Add [core] allow_dotdot_in_ids config flag (default: False) so existing users with '..' in their IDs can opt out of the blocking behavior - Add '..' check in SerializedDAG.create_dagrun() before the regex check, fixing the test_dag_run_id_rejects_path_traversal failure where create_dagrun raised a regex mismatch error before the traversal check - Collapse multi-line raise ValueError in dagrun.py to fix static check - Make all '..' checks conditional on allow_dotdot_in_ids config * refactor: rename allow_dotdot_in_ids to allow_double_dot_in_ids, bump version_added to 3.3.0

apache#63296 added a check that blocks `..` in IDs to prevent path traversal in airflow.utils.helpers.validate_key, gated by [core] allow_double_dot_in_ids. Dag and task authoring now use the Task SDK validate_key, which never got that check, so IDs like a..b are accepted even when the flag is off. Add the same check to the Task SDK validator so the two validators agree.

YoannAbriel requested review from XD-DENG and ashb as code owners March 10, 2026 20:07

potiuk requested changes Mar 10, 2026
View reviewed changes

YoannAbriel force-pushed the fix/issue-63295 branch 6 times, most recently from 4897b94 to 1e0378dCompare March 16, 2026 16:08

ferruzzi reviewed Mar 17, 2026
View reviewed changes

Comment threadairflow-core/newsfragments/63296.significant.rst

YoannAbriel requested a review from bolkedebruin as a code owner March 17, 2026 22:07

YoannAbriel force-pushed the fix/issue-63295 branch 4 times, most recently from 507874d to 1c42375Compare March 23, 2026 13:09

ferruzzi reviewed Mar 23, 2026
View reviewed changes

Comment threadairflow-core/src/airflow/config_templates/config.yml Outdated
Comment threadairflow-core/src/airflow/config_templates/config.yml Outdated

YoannAbriel added 4 commits March 23, 2026 20:05

fix: block path traversal via ".." in dag_id and run_id
0cb35a8
validate_key() and validate_run_id() allow ".." which can be used for path traversal when these values end up in log file paths. Reject any key or run_id containing ".." early in validation. Closes: apache#63295

Add newsfragment for breaking change
51ea5a7

refactor: rename allow_dotdot_in_ids to allow_double_dot_in_ids, bump…
1333ab4
… version_added to 3.3.0

YoannAbriel force-pushed the fix/issue-63295 branch from 1c42375 to 1333ab4Compare March 23, 2026 19:05

ferruzzi approved these changes Mar 23, 2026
View reviewed changes

ferruzzi requested a review from potiuk March 23, 2026 21:42

potiuk approved these changes Mar 24, 2026
View reviewed changes

potiuk merged commit 4f2493d into apache:mainMar 24, 2026
146 checks passed

YoannAbriel deleted the fix/issue-63295 branch March 24, 2026 07:05

vatsrahul1001 added this to the Airflow 3.3.0 milestone Jun 15, 2026

jason810496 mentioned this pull request Jul 26, 2026
Warn on suspicious Dag and task IDs at Go SDK build time #69965
Merged
1 task

Andrushika mentioned this pull request Jul 28, 2026
Reject consecutive dots in Dag and task IDs in the Task SDK #70630
Open
1 task

coderabbitaiBot mentioned this pull request Aug 25, 2026
Fix TaskGroupWithTimeout teardown initialization and remove redundant .as_teardown() calls CIeNET-International/ml-auto-solutions-3#296
Open
4 tasks

Navigation Menu

Uh oh!

fix: block path traversal via ".." in dag_id and run_id - #63296

fix: block path traversal via ".." in dag_id and run_id#63296
potiuk merged 4 commits into
apache:mainfrom
YoannAbriel:fix/issue-63295

YoannAbriel commented Mar 10, 2026

Uh oh!

potiuk left a comment

Uh oh!

potiuk commented Mar 10, 2026

Uh oh!

ferruzzi commented Mar 10, 2026

Uh oh!

YoannAbriel commented Mar 10, 2026

Uh oh!

ferruzzi commented Mar 10, 2026

Uh oh!

ferruzzi left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ferruzzi left a comment

Uh oh!

potiuk commented Mar 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

YoannAbriel commented Mar 10, 2026

Problem

Root Cause

Fix

Was generative AI tooling used to co-author this PR?

Uh oh!

potiuk left a comment

Choose a reason for hiding this comment

Uh oh!

potiuk commented Mar 10, 2026

Uh oh!

ferruzzi commented Mar 10, 2026

Uh oh!

YoannAbriel commented Mar 10, 2026

Uh oh!

ferruzzi commented Mar 10, 2026

Uh oh!

ferruzzi left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ferruzzi left a comment

Choose a reason for hiding this comment

Uh oh!

potiuk commented Mar 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants